CertificateError: hostname does not match

Question

I use a proxy (behind the corporate firewall) to enter the https domain. SSL confirmation does not seem good:

CertificateError: hostname 'ats.finra.org:443' doesn't match 'ats.finra.org' 

I use Python 2.7.9 - Mechanize, and I walked past all the login, password, security screens, but it becomes hanging on the certificate.

Any help would be awesome. I tried the monkey found here: Forcing Mechanize using SSLv3

Not working for my code.

If you need a code file, I would be happy to send.

Answer 1

You can avoid this error by ssl monkey patch:

 import ssl ssl.match_hostname = lambda cert, hostname: True 

Answer 2

This error in ssl.math_hostname is displayed in version 2.7.9 (it is not in 2.7.5) and is related not to remove the host name from the hostname: port syntax. The following ssl.match_hostname entry fixes the error. Put this in front of your mechanization code:

 import functools, re, urlparse import ssl old_match_hostname = ssl.match_hostname @functools.wraps(old_match_hostname) def match_hostname_bugfix_ssl_py_2_7_9(cert, hostname): m = re.search(r':\d+$',hostname) # hostname:port if m is not None: o = urlparse.urlparse('https://' + hostname) hostname = o.hostname old_match_hostname(cert, hostname) ssl.match_hostname = match_hostname_bugfix_ssl_py_2_7_9 

Now the following mechanization code should work:

 import mechanize import cookielib br = mechanize.Browser() # Cookie Jar cj = cookielib.LWPCookieJar() br.set_cookiejar(cj) # Browser options br.set_handle_equiv(True) br.set_handle_gzip(True) br.set_handle_redirect(True) br.set_handle_referer(True) br.set_handle_robots(False) # Follows refresh 0 but not hang on refresh > 0 br.set_handle_refresh(mechanize._http.HTTPRefreshProcessor(), max_time=1) br.addheaders = [('User-Agent', 'Nutscrape 1.0')] # Use this proxy br.set_proxies({"http": "localhost:3128", "https": "localhost:3128"}) r = br.open('https://www.duckduckgo.com:443/') html = br.response().read() # Examine the html response from a browser f = open('foo.html','w') f.write(html) f.close() 

Answer 3

In my case, the DNS name of the certificate was ::1 (for local testing purposes), and checking the host name with

 ssl.CertificateError: hostname '::1' doesn't match '::1' 

To fix this somewhat correctly, I decapitated ssl.match_hostname with

 import ssl ssl.match_hostname = lambda cert, hostname: hostname == cert['subjectAltName'][0][1] 

Which really checks to see if hostnames match.